Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 701:

  You have an Azure subscription that contains a Standard SKU Azure container registry named ContReg1.

  You need to ensure that ContReg1 supports geo-replication.

  What should you do first for ContReg1?

  A. Enable Admin user.
  B. Add a scope map.
  C. Add an automation task.
  D. Create a cache rule.
  E. Upgrade the SKU.
  E. Upgrade the SKU.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Upgrade the SKU.

  --------------------------------------------------------------------------------

  - Geo-replication for Azure Container Registry is a Premium-tier capability.

  - Since the registry is Standard SKU, the first step is to upgrade it to Premium, then configure geo-replication.

  Why the other options are incorrect:

  - Enable Admin user / Add a scope map / Add an automation task / Create a cache rule: None of these change the service tier, so they do not enable geo-replication support.

  References:

  1. Microsoft. (n.d.). Azure subscription and service limits, quotas, and constraints. Microsoft Learn.

  https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits Date Updated: Unable to locate in this capture (see page footer) Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - ACR feature gating by SKU is a classic AZ-104 pattern (Basic vs Standard vs Premium).

  Summary:

  ACR tier-based capabilities (geo-replication).

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.1 Create and manage an Azure container registry

• Question 702:

  HOTSPOT

  You have an Azure subscription that contains the resource groups shown in the following table.

  

  RG1 contains the resources shown in the following table.

  

  RG2 contains the resources shown in the following table.

  

  You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1.

  Which resources should you identify? To answer, select the appropriate options in the answer area.

  

  

  ---

  {Dropdown 1}: IP1, VNET1, and storage1

  {Dropdown 2}: IP2, VNET2, and storage2

  Why this is correct:

  - A “Read-only“ lock on a *resource group* prevents moving resources “in or out“ of that resource group. In this scenario, RG1 has “no“ resource-group lock and RG2 has a “Delete“ lock (not Read-only), so the RG-level locks do not block the moves.

  - A “Read-only“ lock on an individual *resource* still allows the resource to be moved.

  - Therefore, all listed resources can be moved between RG1 and RG2.

  Why the other options are not correct:

  - Any option excluding VNET1/VNET2 due to their Read-only locks is incorrect because a Read-only lock on a resource does not prevent moving that resource.

  - “None” is incorrect because there is no RG-level Read-only lock blocking moves.

  Microsoft Exam Tips:

  - For “resource moves“, always check for “Read-only locks at the resource-group scope“ first-those are the most common “silent blockers.”

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |_1.3 Manage Azure subscriptions and governance |_ 1.3.2 Configure resource locks

• Question 703:

  You have an Azure subscription that contains the resources shown in the following table.

  

  All virtual machines run Windows Server 2016.

  On VM1, you back up a folder named Folder1 as shown in the following exhibit.

  

  You plan to restore the backup to a different virtual machine.

  You need to restore the backup to VM2.

  What should you do first?

  A. From VM2, install the Microsoft Azure Recovery Services Agent
  B. From VM1, install the Windows Server Backup feature
  C. From VM2, install the Windows Server Backup feature
  D. From VM1, install the Microsoft Azure Recovery Services Agent
  A. From VM2, install the Microsoft Azure Recovery Services Agent

  ---

  From VM2, install the Microsoft Azure Recovery Services Agent.

  The exhibit shows a "Specify Backup Schedule (Files and Folders)" wizard, which aligns with file/folder backups performed by the Microsoft Azure Recovery Services (MARS) agent (Azure Backup agent), not VM-level backup.

  To restore those file/folder backups to a different machine (VM2), VM2 must be able to communicate with the same Recovery Services vault and perform a restore operation. The prerequisite is to install the MARS agent on VM2 (and then register it to the vault using vault credentials and the same passphrase used to encrypt the backups).

  Therefore, the first action is to install the Microsoft Azure Recovery Services Agent on VM2.

  Why the other options are not correct:

  - Install the Windows Server Backup feature (on VM1 or VM2):

  Windows Server Backup is not the mechanism shown in the exhibit for vault-based Azure file/folder backup/restore. The restore target must use the Azure Backup (MARS) agent workflow.

  - Install the Microsoft Azure Recovery Services Agent on VM1:

  VM1 already has the backup configured and running. The goal is restoring to VM2, so VM2 needs the agent.

  Microsoft Exam Tips:

  - "Files and folders" backup schedule wizard typically indicates the MARS agent, not VM-level Azure VM Backup.

  - Restoring to a different VM generally requires the target VM to have the same restore tooling installed (here: MARS agent) and be registered appropriately with the vault.

  - Watch for distractors like "Windows Server Backup feature" when the scenario is clearly Azure Backup agent-based.

  Summary:

  - Azure Backup file/folder protection using the MARS agent

  - Restoring backups to a different VM requires installing the MARS agent on the target machine

  - Differentiating MARS agent backups from Windows Server Backup and VM-level Azure VM Backup

  AZ-104 Exam Objective Alignment (Hierarchy)

  5.0 Monitor and maintain Azure resources | 5.2 Implement backup and recovery | 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 704:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that data transfers between storage1 and VM1 do NOT traverse the internet

  What should you configure for storage1?

  A. data protection
  B. a private endpoint
  C. Public network access in the Firewalls and virtual networks settings
  D. a shared access signature (SAS)
  B. a private endpoint

  ---

  Explanation

  ----------------------------------------------------------------------

  a private endpoint

  ----------------------------------------------------------------------

  To ensure storage traffic between a VM and a Storage account does **not traverse the public internet**, you configure a **Private Endpoint** for the Storage account. A private endpoint gives the storage service a private IP in your VNet so traffic flows privately over Microsoft's backbone rather than to a public endpoint.

  Why the other options are not correct:

  - data protection: not a networking control for routing/paths.

  - Public network access in the Firewalls and virtual networks settings: this can restrict/allow public access but does not inherently provide a private IP path like Private Endpoint.

  - a shared access signature (SAS): SAS controls authorization, not network path.

  ---------------------------------------------------------------------- References:

  1. Azure Private Link documentation (private endpoint concept). https://learn.microsoft.com/en-us/azure/private-link/ Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ----------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: Private Endpoint = "private IP to PaaS"; Service Endpoint = "secure PaaS access but still service public endpoint."

  - If the question emphasizes "not traverse the internet," Private Endpoint is the strongest default.

  Summary:

  Preventing public internet traversal for Storage access using Private Endpoint.

  ---------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.5 Configure private endpoints for Azure PaaS

• Question 705:

  HOTSPOT

  You manage two Azure subscriptions named Subscription1 and Subscription2.

  Subscription1 has the following virtual networks:

  

  The virtual networks contain the following subnets:

  

  Subscription2 contains the following virtual network:

  1. Name: VNETA 2. Address space: 10.10.128.0/17 3. Location: Canada Central

  VNETA contains the following subnets:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. A Site-to-Site connection can be established between VNET1 and VNET2: Yes

  2. VNET1 and VNET2 can be peered: Yes

  3. VNET1 and VNETA can be peered: Yes

  Why this is correct:

  - Site-to-site VPN connections can be established between VNets as long as you deploy the required VPN gateways and configuration; different regions do not prevent S2S connectivity.

  - VNet peering is supported across regions (global VNet peering) and across subscriptions.

  - All involved VNets have **non-overlapping** address spaces:

  - VNET1: 10.10.10.0/24

  - VNET2: 172.16.0.0/16

  - VNETA: 10.10.128.0/17 Therefore, peering is allowed for VNET1<->VNET2 and VNET1<->VNETA.

  Why the other options are not correct:

  - Any “No” for peering would typically require overlapping address spaces or unsupported peering scope-neither is present here.

  - Any “No” for S2S would typically require missing gateways or invalid address overlap; the statement asks if it *can* be established, which is true.

  Exam Tips

  - For peering questions, first check:

  (1) address space overlap (must be none),

  (2) same/different regions (global peering is allowed),

  (3) subscription/tenant constraints.

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy

  4.0 - Implement and manage virtual networking (15–20%)

  |__ 4.1 - Configure and manage virtual networks in Azure

  |__ |__ 4.1.2 - Create and configure virtual network peering

• Question 706:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: You join Computer2 to Azure Active Directory (Azure AD)

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  - The point-to-site VPN uses a self-signed certificate. Connecting from a new computer (Computer2) requires that the VPN client configuration and the appropriate client certificate material be present on that computer.

  - Joining Computer2 to Azure AD does not provide the certificate required for certificate-based point-to-site authentication and does not, by itself, enable the VPN connection. (1)

  Why the other selection is incorrect:

  - Yes

  - The proposed action does not satisfy the authentication requirement for certificate-based P2S connectivity.

  -------------------------------------------------------------------------------- References:

  1. About point-to-site VPN https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about Date Modified: Unable to locate date modified on page Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: For P2S VPN, focus on **authentication type** (cert vs Entra ID vs RADIUS) and what must exist on the client.

  - "Join device to Azure AD" is commonly tested for device identity/management-not as a fix for cert-based VPN auth.

  Summary:

  Certificate-based point-to-site VPN requirements versus Azure AD join.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.5 Troubleshoot network connectivity |__ 4.2 Configure secure access to virtual networks

• Question 707:

  You need to move the blueprint files to Azure.

  What should you do?

  A. Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
  B. Use the Azure Import/Export service.
  C. Generate an access key. Map a drive, and then copy the files by using File Explorer.
  D. Use Azure Storage Explorer to copy the files.
  D. Use Azure Storage Explorer to copy the files.

  ---

  Explanation

  Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.

  Scenario:

  Planned Changes include: move the existing product blueprint files to Azure Blob storage. Technical Requirements include: Copy the blueprint files to Azure over the Internet.

  References: https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-blob-using-azure-storage-explorer

• Question 708:

  HOTSPOT

  You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one subnet named Sunet1.

  Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.

  You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against the collected data.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Resource to create:

  An Azure Log Analytics workspace

  Resource on which to enable diagnostics:

  NSG1

  Explanation:

  You need to collect data about the IP addresses that connect to ILB1 and then run interactive queries from the Azure portal. The best way to do that is to capture network traffic metadata via NSG logging and store it in a Log Analytics workspace so you can query it with KQL (Logs blade).

  Why “An Azure Log Analytics workspace” (and not the other choices):

  - Log Analytics workspace: stores log data and supports interactive querying in the Azure portal using Kusto Query Language (KQL).

  - Azure Storage account: can store diagnostic logs, but it’s not the best destination for interactive portal queries (you’d typically export and analyze elsewhere).

  - Azure Event Grid: event routing for event-based architectures, not for storing/querying network connection telemetry.

  Why enable diagnostics on “NSG1” (and not the other choices):

  - NSG1 is associated to the subnet that contains ILB1 and the backend VMs. NSG-related logging/telemetry is where you capture allowed/denied flow information (source/destination IPs, ports, protocols) that helps identify which IPs connect to services behind the ILB.

  - Enabling diagnostics on ILB1 or “the Azure virtual machines” won’t give you the same network-flow visibility you need for “IP addresses that connect to ILB1” in a query-friendly way.

  References (APA):

  1. Microsoft Learn. (2025, November 4). Resource logs in Azure Monitor. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs

  - Last updated: 2025-11-04. Date accessed: 01/27/2026.

  2. Microsoft Learn. (2025, August 29). Log query scope and time range in Azure Monitor. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/scope

  - Last updated: 2025-08-29. Date accessed: 01/27/2026.

  Microsoft Exam Tips:

  - If a question says you must run “interactive queries in the Azure portal,” think: **Log Analytics workspace + Azure Monitor Logs (KQL)**.

  - If the question is about “who/what IP is connecting,” think: **NSG logging/flow data** (captures src/dst IP + port metadata).

  Summary:

  This question tested choosing a logging destination that supports portal-based querying (Log Analytics) and selecting the right resource layer to emit network connection telemetry (NSG).

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10–15%) |__ 5.1 Monitor resources in Azure |__ 5.1.2 Configure log settings in Azure Monitor |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 709:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription with a storage account.

  You want to use the Azure Import/Export service to import files to the storage account.

  Solution: You create a XML manifest file.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Azure Import/Export jobs do not use an XML "manifest file" as the required job-definition input artifact. For Import/Export, Microsoft's tooling guidance centers on generating and providing CSV-based job files (notably dataset.csv and driveset.csv) produced/edited as part of the drive preparation workflow. Therefore, "create an XML manifest file" does not meet the goal of preparing the correct artifacts for an Import/Export job.

  References:

  1. Preparing hard drives for an import job (Azure Import/Export) - Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/azure/storage/common/storage-import-export-tool-preparing-hard-drives-import Date Modified: As shown on page (Microsoft Learn) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - Many exam items distinguish among Azure data transfer options (Import/Export vs. Data Box vs. AzCopy). Focus on which artifacts each service requires.

  Summary:

  - Azure Import/Export job preparation artifacts and file formats.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 710:

  You have a Microsoft SQL Server Always On availability group on Azure virtual machines. You need to configure an Azure internal load balancer as a listener for the availability group. What should you do?

  A. Enable Floating IP.
  B. Set Session persistence to Client IP and protocol.
  C. Set Session persistence to Client IP.
  D. Create an HTTP health probe on port 1433.
  A. Enable Floating IP.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Enable Floating IP.

  --------------------------------------------------------------------------------

  For SQL Server Always On availability group listeners behind an Azure internal load balancer, you typically must enable Floating IP (Direct Server Return). This supports the listener's IP configuration behavior and allows the load balancer to forward traffic correctly to the active replica.

  Why other options are not correct:

  - Session persistence settings do not address the listener requirement for DSR/Floating IP.

  - An HTTP health probe on port 1433 is not appropriate (SQL uses TCP; health probes are configured as TCP probes on a dedicated probe port depending on the design).

  -------------------------------------------------------------------------------- References:

  1. Configure SQL Server availability group listener with Azure Load Balancer https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure Date Modified: Unable to locate date modified

  Date Accessed: 01/25/2026

  2. Floating IP (Direct Server Return) for Azure Load Balancer https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For SQL AG listeners with ILB, memorize: "Enable Floating IP (DSR)" is a frequent requirement.

  - Don't confuse persistence (sticky) with DSR/Floating IP.

  -------------------------------------------------------------------------------- Summary:

  Configuring Azure internal load balancer settings required for SQL Server Always On availability group listeners.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer